diff options
author | Felipe Artur <felipefac@gmail.com> | 2019-02-22 17:31:02 +0300 |
---|---|---|
committer | Felipe Artur <felipefac@gmail.com> | 2019-02-25 20:01:28 +0300 |
commit | b6e06b155964af3437b227e19fc80e7c96bd5ee6 (patch) | |
tree | 50fa14aaeabe1072bbf0034ab912687589eba242 /spec | |
parent | ce13864265ed3b3f7be6437921bb9773a0cf2fa2 (diff) |
Prevent disclosing project milestone titles
Prevent unauthorized users having access to milestone titles
through autocomplete endpoint.
Diffstat (limited to 'spec')
-rw-r--r-- | spec/controllers/projects/autocomplete_sources_controller_spec.rb | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/spec/controllers/projects/autocomplete_sources_controller_spec.rb b/spec/controllers/projects/autocomplete_sources_controller_spec.rb new file mode 100644 index 00000000000..382e6d547df --- /dev/null +++ b/spec/controllers/projects/autocomplete_sources_controller_spec.rb @@ -0,0 +1,37 @@ +# frozen_string_literal: true + +require 'spec_helper' + +describe Projects::AutocompleteSourcesController do + describe 'GET milestones' do + let(:user) { create(:user) } + let(:group) { create(:group, :public) } + let(:project) { create(:project, :public, namespace: group) } + let!(:project_milestone) { create(:milestone, project: project) } + let!(:group_milestone) { create(:milestone, group: group) } + + before do + sign_in(user) + end + + it 'lists milestones' do + group.add_owner(user) + + get :milestones, format: :json, params: { namespace_id: group.path, project_id: project.path } + + milestone_titles = json_response.map { |milestone| milestone["title"] } + expect(milestone_titles).to match_array([project_milestone.title, group_milestone.title]) + end + + context 'when user cannot read project issues and merge requests' do + it 'renders 404' do + project.project_feature.update!(issues_access_level: ProjectFeature::PRIVATE) + project.project_feature.update!(merge_requests_access_level: ProjectFeature::PRIVATE) + + get :milestones, format: :json, params: { namespace_id: group.path, project_id: project.path } + + expect(response).to have_gitlab_http_status(404) + end + end + end +end |